Re: faking session data

"Marcus" <JumpMan222@xxxxxxx> kirjoitti
viestissä:fw1Re.598$sF6.421@xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
> Hello all,
>
> I have written numerous functions that check all user entered data on my
> site via POST and GET. My question is this: once my data checks out as
> being valid, I sometimes store it in SESSION as I move between pages, and
> eventually use the values in SESSION to update my database. Do I need to
> re-check the values in SESSION to make sure they are still valid before
> updating the database? In other words, I know session data resides on the
> server, but how possible/likely is it that a malicious user could fake
> session data after or in lieu of my initial error checks? All pages are
> protected by SSL if that makes any difference. Thanks in advance.
>

I'd say your session data is quite secure. Although, you might concider
these precautions:
http://www.ericisgreat.com/tinfoilhats/

--
SETI @ Home - Donate your cpu's idle time to science.
Further reading at <http://setiweb.ssl.berkeley.edu/>
Kimmo Laine <eternal.erectionN0@xxxxxxxxxxxxx>


.

Relevant Pages

  • Re: Creating "remember me" functionality
    ... the session data is erased. ... When someone logs into your website, you need to use setcookie on the next ... This makes it a set size charfor a database. ... $_Cookie for the required fields. ...
    (alt.php)
  • Re: cookies from asp to php
    ... >>with php. ... If it's possible for visualbasic to store the session data in a database, ... there is no trouble for PHP to access it. ...
    (alt.php)
  • Re: Session variable data being lost
    ... checks if there is no session data available. ... required database field - this is data that was held in a session ... store - using SQL Server as my storage. ... Dim FILENAME as String = Server.MapPath ...
    (microsoft.public.dotnet.framework.aspnet)
  • faking session data
    ... I have written numerous functions that check all user entered data on my site via POST and GET. ... once my data checks out as being valid, I sometimes store it in SESSION as I move between pages, and eventually use the values in SESSION to update my database. ...
    (comp.lang.php)
  • Re: [PHP] session_decode from session handler
    ... What I am trying to do is show a list of online users and the page ... Instead of crawling through everybody's session data all the time, ... Then a simple SQL query against the DB tells you who is looking at what. ...
    (php.general)